diff --git a/apps/production/wikijs-config.py b/apps/production/wikijs-config.py
index 954f203..602bc80 100644
--- a/apps/production/wikijs-config.py
+++ b/apps/production/wikijs-config.py
@@ -122,22 +122,7 @@ def login() -> str:
     return d["jwt"]
 
 
-def kv(d: dict) -> list:
-    return [{"key": k, "value": json.dumps({"value": v})} for k, v in d.items()]
-
-
-def ensure_oidc(jwt: str):
-    cfg = {
-        "clientId": CLIENT_ID, "clientSecret": CLIENT_SECRET,
-        "authorizationURL": f"{AUTH}/application/o/authorize/",
-        "tokenURL": f"{AUTH}/application/o/token/",
-        "userInfoURL": f"{AUTH}/application/o/userinfo/",
-        "issuer": f"{AUTH}/application/o/{APP_SLUG}/",
-        "logoutURL": f"{AUTH}/application/o/{APP_SLUG}/end-session/",
-        "emailClaim": "email", "displayNameClaim": "name",
-        "groupsClaim": "groups", "mapGroups": True,
-        "skipUserProfile": False,
-    }
+def _set_strategies(jwt: str, oidc_config: list):
     strategies = [
         {  # local muss in der Liste bleiben (Admin nutzt es), sonst Fehler.
             "key": "local", "strategyKey": "local", "displayName": "Local",
@@ -147,7 +132,7 @@ def ensure_oidc(jwt: str):
         {
             "key": STRATEGY_KEY, "strategyKey": "oidc", "displayName": "Authentik",
             "order": 1, "isEnabled": True, "selfRegistration": True,
-            "domainWhitelist": [], "autoEnrollGroups": [], "config": kv(cfg),
+            "domainWhitelist": [], "autoEnrollGroups": [], "config": oidc_config,
         },
     ]
     r = gql(
@@ -156,7 +141,24 @@ def ensure_oidc(jwt: str):
         jwt, {"s": strategies},
     )["authentication"]["updateStrategies"]["responseResult"]
     if not r["succeeded"]:
-        sys.exit(f"OIDC-Strategy fehlgeschlagen: {r['message']}")
+        sys.exit(f"updateStrategies fehlgeschlagen: {r['message']}")
+
+
+def ensure_oidc(jwt: str):
+    # Quellcode-verifiziert: Wiki.js liest jeden Config-Wert via
+    # _.get(JSON.parse(value), 'v', null) -> der Wert MUSS als {"v": …} kodiert sein.
+    cfg = {
+        "clientId": CLIENT_ID, "clientSecret": CLIENT_SECRET,
+        "authorizationURL": f"{AUTH}/application/o/authorize/",
+        "tokenURL": f"{AUTH}/application/o/token/",
+        "userInfoURL": f"{AUTH}/application/o/userinfo/",
+        "issuer": f"{AUTH}/application/o/{APP_SLUG}/",
+        "logoutURL": f"{AUTH}/application/o/{APP_SLUG}/end-session/",
+        "emailClaim": "email", "displayNameClaim": "name",
+        "groupsClaim": "groups", "mapGroups": True,
+    }
+    oidc_config = [{"key": k, "value": json.dumps({"v": v})} for k, v in cfg.items()]
+    _set_strategies(jwt, oidc_config)
     log("OIDC-Strategy gesetzt")